Well we only really use this for checking the link isn't the same, at the moment the public_url_helper assumes it's within a request, so generate it in the controller and pass it (like the other hidden fields).